Skip to content
−20%Get 20% off your first order.Shipped from the EU, 1 to 5 working days−20%Get 20% off your first order.Shipped from the EU, 1 to 5 working days−20%Get 20% off your first order.Shipped from the EU, 1 to 5 working days−20%Get 20% off your first order.Shipped from the EU, 1 to 5 working days−20%Get 20% off your first order.Shipped from the EU, 1 to 5 working days−20%Get 20% off your first order.Shipped from the EU, 1 to 5 working days
ENDE
BioXgen Europe
ENDE
OrdersCart0
Research use only — not for use in humans or animalsShips from the EU · 1–5 working days
← Back

Privacy policy

This policy describes which personal data we process when you visit BioXgen Europe (bioxgen.eu), order from us or write to us — as the website actually works.

1. Controller

BIOXGEN Sp. z o.o.
ul. Stanisława Taczaka 24 lok. 103
61-819 Poznań
Poland

Phone: +48734601708
Email: support@bioxgen.eu

We have not appointed a data protection officer, as we are not required to. For any data protection question, please use the contact details above.

2. Hosting and server logs

When you open the website, a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in Germany receives the encrypted connection and forwards it to our application server. That server, which holds the website, the database, files and the encrypted backups, is operated by Olivenet Network S.L. in Spain. Both act as our processors under Article 28 GDPR; all data stays in the EU.

For every request, the web server logs technically necessary information: IP address, date and time, the address requested, the status code and the browser identifier. This serves the secure and stable operation of the site (Article 6(1)(f) GDPR). The logs are continuously overwritten and are normally gone within a few days.

So that prices include your country’s VAT, we estimate from your IP address, on each request, the country you are visiting from. This uses a database on our own server; the address is not sent to anyone for it and the result is not stored (Article 6(1)(f) GDPR — correct price information). You can choose the country yourself at the bottom left of every page.

3. Cookies

We use only cookies that are technically necessary for the website (Article 6(1)(b) and (f) GDPR and the corresponding national rules on storage on your device). There are no advertising cookies and no third-party content such as Google, Facebook or embedded videos. Only if you agree to visitor statistics (section 4) do we also set a statistics cookie of our own (Article 6(1)(a) GDPR and the corresponding national rules on storage on your device).

  • bx_age_ok — remembers your age confirmation, 180 days
  • bx_consent — remembers your cookie choice, 1 year; change it any time under “Cookie settings”
  • bx_cart — keeps your basket between pages, 7 days
  • bx_country — remembers the country you chose for the prices shown, only if you change it, 1 year
  • bx_country_seen (browser storage, not a cookie) — remembers that the country notice has been shown in full once, until you clear it
  • bx_chat — links your chat messages, only if you use the chat, 30 days
  • a session cookie while you are signed in to your account
  • bx_vid — only with your consent: a random identifier by which we recognise your browser on later visits (section 4), 1 year; deleted when you withdraw consent

4. Visitor statistics

Only if you agree to statistics in the cookie notice do we record in full how you use the website — on our own server, without any third party. For this we set the cookie bx_vid with a random identifier, so that we recognise your browser on later visits and see your visits as one history. Views less than 30 minutes apart are counted as one visit.

We store your IP address and browser identifier, each page viewed with its date and time and the details in its address (such as search terms, filters and sort order; access codes and email addresses are removed), the domain of the referring page, campaign details from the link you followed (utm parameters), your searches on the site with the number of results, the links and buttons you click, how long a page was shown and how far down you scrolled, what you put in or take out of the basket, and whether you order. From the IP address we derive the country, region, city and network operator (such as a mobile carrier, a university or a company) with a database on our own server, and from the browser identifier the device class, browser and operating system. We do not record what you type into forms, except search terms.

If you are signed in to your customer account or place an order, the history is linked to your account or order; the order also records where the visit came from (such as a search engine, a social network or a newsletter), the campaign and the page it started on. This shows us how visitors use the site, where they fail to find something and which routes lead to orders. Only staff authorised for it can see it. The IP address and browser identifier are deleted after 90 days, the rest of the statistics after 400 days.

Without your consent — until you agree, or if you choose “Essential only” — we record use of the site anonymously only: pages viewed with their search terms and filters, searches with the number of results, links and buttons clicked, how long a page was shown and how far it was scrolled, basket steps and whether an order was placed, together with the country, region and city and the device class, browser and operating-system family. No cookie is set for this, and the IP address, browser identifier and network operator are not stored; views on the same day are grouped by a hash whose key is generated anew each day and deleted after 36 hours at most, so you cannot be recognised the next day. This is never linked to a customer account or an order. The legal basis is our legitimate interest in improving the site and finding faults (Article 6(1)(f) GDPR); you may object at any time. If your browser sends the “Global Privacy Control” signal, nothing is recorded without your consent.

The legal basis for statistics with your consent is your consent (Article 6(1)(a) GDPR and the corresponding national rules on access to your device). You can withdraw it at any time under “Cookie settings” at the foot of every page; from then on we record only anonymously as described above, and the bx_vid cookie is deleted. On request we also delete the history already recorded. We keep a record of your choice, with a hash of your IP address and your browser identifier, as proof of it (Article 6(1)(c) with Article 7(1) GDPR).

5. Orders and customer accounts

For orders we process your name, email address, delivery and billing address, phone number (for the carrier), where applicable your company and VAT number, the products ordered with their lot numbers, your confirmation of research use, and receipt of payment. The legal basis is performance of the contract (Article 6(1)(b) GDPR) and our legal obligation to keep invoices and accounting records (Article 6(1)(c) GDPR).

If you open a customer account, we also store your password (only as a secure hash) and your past orders until you ask us to delete the account.

Disclosure:

  • Carriers (depending on destination DHL, UPS, GLS or another carrier named at checkout) receive your name, delivery address and phone number to deliver the parcel.
  • VAT numbers are checked through the European Commission’s VAT Information Exchange System (VIES).
  • Payments are made by bank transfer; our bank gives us the payer’s name, account details and payment reference.

6. Emails

Order confirmations, payment and shipping notices and replies to enquiries are sent through Mailgun (Mailgun Technologies, Inc.), EU data centre region, as our processor. As Mailgun is a US company, access from the US cannot be ruled out; the transfer is safeguarded by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. We send marketing emails only if you have subscribed to the newsletter (section 6a).

6a. Newsletter

If you ask for the newsletter — in the form at the foot of every page, when registering or when ordering — we first send you an email with a confirmation link; you receive the newsletter only once you click it (double opt-in). As proof we store your email address, your language, when and where you signed up and confirmed, the wording you agreed to, a hash of your IP address and your browser identifier (Article 6(1)(a), and Article 6(1)(c) with Article 7(1) GDPR).

The newsletter comes about every 6 to 8 weeks with products in stock, occasional discount codes and research background on individual compounds. If you are also a customer, we choose content by your previous orders (such as a product you have ordered before); a personal discount code is linked to your order when you redeem it. Links in the newsletter carry a campaign tag so we can see how many visits and orders an issue leads to in total; we do not measure whether you open an email. It is sent through Mailgun (section 6).

You can unsubscribe at any time with the link in every issue. We keep the proof of your consent for up to three years after you unsubscribe, to be able to show it.

7. Certificate requests and contact

If you request a product’s certificate of analysis or write to us, we process your name, email address and your request in order to reply (Article 6(1)(b) or (f) GDPR).

8. Chat

If you use the chat window, your message is forwarded to our staff, who reply through the Telegram messaging service. Together with the message we transmit your IP address, an approximate location derived from it (city and country, determined on our own server), your browser and device, language, time zone, the page you are writing from and, where applicable, your customer account — so that we can answer correctly and recognise abuse (Article 6(1)(b) and (f) GDPR).

Telegram is operated by Telegram Messenger Inc. and Telegram FZ-LLC (Dubai, United Arab Emirates), a country without an adequacy decision by the European Commission. A level of data protection comparable to the EU is not guaranteed there. The chat is optional; if you prefer, please write to us by email instead.

9. How long we keep data

We delete personal data once it is no longer needed for its purpose and no legal retention obligation applies. Invoices and accounting records are kept for five years from the end of the calendar year in which the tax arose, as Polish tax and accounting law requires, and then deleted.

10. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where we process data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Article 21). Please write to us at the address above.

You may also lodge a complaint with a data protection supervisory authority, in particular in the member state where you live, or with the authority responsible for us: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Moniuszki 1A, 00-014 Warsaw, Poland.

11. Obligation to provide data; no automated decisions

The details marked as required at checkout are needed to conclude and perform the contract; without them we cannot deliver. There is no automated decision-making, including profiling, under Article 22 GDPR.

Last updated: 26 October 2026 (2)